Open Redirect

import WebKit
import Foundation

class SecureWebViewController: UIViewController {
    var webView: WKWebView!

    // List of allowed domains
    private let allowedDomains = [
        "example.com",
        "trusted-partner.com",
        "api.example.com"
    ]

    // List of allowed URL schemes
    private let allowedSchemes = ["http", "https"]

    // FIXED: Validate URL before loading
    func loadUserURL(urlString: String) {
        guard let url = URL(string: urlString),
              isURLAllowed(url)
        else {
            print("Rejected untrusted URL: \(urlString)")
            showError(message: "Invalid or untrusted URL")
            return
        }

        webView.load(URLRequest(url: url))
    }

    // URL validation with scheme and domain whitelist
    func isURLAllowed(_ url: URL) -> Bool {
        // Validate scheme
        guard let scheme = url.scheme?.lowercased(),
              allowedSchemes.contains(scheme)
        else {
            return false
        }

        // Validate domain against whitelist
        guard let host = url.host else {
            return false
        }

        return allowedDomains.contains { allowedDomain in
            host == allowedDomain || host.hasSuffix("." + allowedDomain)
        }
    }

    // FIXED: Deep link with validation
    func handleDeepLink(url: URL) {
        guard let components = URLComponents(url: url, resolvingAgainstBaseURL: false),
              let redirectParam = components.queryItems?.first(where: { $0.name == "redirect" })?.value,
              let redirectURL = URL(string: redirectParam),
              isURLAllowed(redirectURL)
        else {
            print("Invalid deep link redirect")
            return
        }

        webView.load(URLRequest(url: redirectURL))
    }

    // FIXED: Relative URL only
    func loadRelativeURL(path: String) {
        // Ensure path is relative (no scheme)
        guard !path.contains("://"),
              let baseURL = URL(string: "https://example.com"),
              let url = URL(string: path, relativeTo: baseURL)
        else {
            print("Invalid relative path")
            return
        }

        webView.load(URLRequest(url: url))
    }

    func showError(message: String) {
        let alert = UIAlertController(
            title: "Error",
            message: message,
            preferredStyle: .alert
        )
        alert.addAction(UIAlertAction(title: "OK", style: .default))
        present(alert, animated: true)
    }
}

import Vapor

class SecureVaporHandler {
    // Whitelist of allowed redirect destinations
    private let allowedRedirects: Set<String> = [
        "/dashboard",
        "/profile",
        "/settings",
        "/logout"
    ]

    // FIXED: Validate against whitelist
    func handleRedirect(req: Request) throws -> Response {
        let redirectURL = req.query[String.self, at: "redirect"] ?? "/"

        // Validate redirect URL against whitelist
        guard allowedRedirects.contains(redirectURL) else {
            throw Abort(.badRequest, reason: "Invalid redirect destination")
        }

        return req.redirect(to: redirectURL)
    }

    // FIXED: Login redirect with validation
    func loginRedirect(req: Request) async throws -> Response {
        let username = try req.content.decode(LoginData.self).username
        let nextPage = req.query[String.self, at: "next"] ?? "/dashboard"

        // Authenticate user
        try await req.auth.login(username)

        // Validate redirect is local path only
        guard isLocalPath(nextPage) else {
            return req.redirect(to: "/dashboard")
        }

        return req.redirect(to: nextPage)
    }

    // FIXED: Use indirect reference map
    func apiRedirect(req: Request) throws -> Response {
        guard let target = req.query[String.self, at: "target"] else {
            throw Abort(.badRequest)
        }

        // Map of allowed redirect identifiers
        let redirectMap: [String: String] = [
            "home": "/",
            "profile": "/user/profile",
            "settings": "/user/settings"
        ]

        guard let redirectURL = redirectMap[target] else {
            throw Abort(.badRequest, reason: "Invalid redirect target")
        }

        return req.redirect(to: redirectURL)
    }

    // Helper: Check if path is local (relative)
    private func isLocalPath(_ path: String) -> Bool {
        // Reject absolute URLs with scheme
        if path.contains("://") {
            return false
        }

        // Reject protocol-relative URLs
        if path.hasPrefix("//") {
            return false
        }

        // Ensure path starts with /
        if !path.hasPrefix("/") {
            return false
        }

        return true
    }
}

struct LoginData: Content {
    let username: String
    let password: String
}

import Foundation

extension URL {
    /// Checks if URL is safe to load (allowed scheme and domain)
    func isSafeToLoad(allowedDomains: [String], allowedSchemes: [String] = ["http", "https"]) -> Bool {
        // Check scheme
        guard let scheme = self.scheme?.lowercased(),
              allowedSchemes.contains(scheme)
        else {
            return false
        }

        // Check domain
        guard let host = self.host else {
            return false
        }

        return allowedDomains.contains { allowedDomain in
            host == allowedDomain || host.hasSuffix("." + allowedDomain)
        }
    }

    /// Checks if URL is a relative path (safe for internal navigation)
    func isRelativePath() -> Bool {
        return self.scheme == nil && self.host == nil
    }
}